mcp-consultasdeveiculos@0.0.1

Analysis

This package is a code-less placeholder (package.json + README only, no code, no install scripts) that squats the name mcp-consultasdeveiculos, which is referenced in a third-party project's public documentation as the planned distribution channel (npx -y mcp-consultasdeveiculos-client --token ...) for an MCP client that receives users' API tokens. The package presents itself as a "security research placeholder" reserving the name, but the name squatting reserves a namespace tied to a related client package that harvests API tokens, enabling dependency-confusion / name-confusion abuse against users who install the client expecting the legitimate project's code.